skip to content
Back to
Home Bounties Research Advisories CodeQL Wall of Fame Get Involved Events
December 9, 2022

GHSL-2022-028: Copy/paste cross-site scripting (XSS) in codex-team

GitHub Security Lab

Coordinated Disclosure Timeline


codex-team/editor.js is vulnerable to XSS attacks when copy/pasting specially crafted input into the editor.



Tested Version



Issue: XSS copy/pasting HTML in the editor (GHSL-2022-028)

The processHTML method is passing pasted input into wrapper’s innerHTML.


  1. Open in your browser, enter <img src='foo' onerror='alert(123)'/> in the HTML Input box.
  2. Click Copy as HTML.
  3. Open in your browser.
  4. Paste the content you copied in [2] into the editor.
  5. JavaScript: alert(123) is executed.


This issue may lead to XSS in all projects that depend on editor.js, such as webiny/webiny-js, frappe/frappe, and Jungwoo-An/react-editor-js.



This issue was discovered by CodeQL team members @kaeluka (Stephan Brandauer) and @erik-krogh (Erik Krogh Kristensen), using a CodeQL query originally contributed by community member @bananabr (Daniel Santos).


You can contact the GHSL team at, please include a reference to GHSL-2022-028 in any communication regarding this issue.

GitHub Security Advisories

We recommend you create a private GitHub Security Advisory for these findings. This also allows you to invite the GHSL team to collaborate and further discuss these findings in private before they are published.